c) Security

Question 1

safeguarding files and records

Answer 1

• data can be protected through the use of internal and external labels and file protection rings
• ALL critical application data should be backed up and stored in a secure off site lcoation

Question 2

Son-Father-Grandfather concept

Answer 2

• Whats the version of the data
• The most recent file is the son, second most recent file is the father and the preceding file is the gfather
• Process includes reading the previous file, recording (adding) transactions being processed and creating a new updated master file.
• There are always at least two backup files that can be used to recreate the destroyed file

Question 3

Backups of systems that can be shut down

Answer 3

files or databases that have changed since the last backup (or just all data) can be backed up using son, father, gfather concept

Question 4

Backups of systems that do not shut down

Answer 4

files or databases that have changed since the last backup (or just all data) can be backed up sing son, father, gfather concept

Question 5

mirroring

Answer 5

use of a backup computer to duplicate all of the processes and transactions on the primary computer-can be expensive

Question 6

Uninterrupted Power supply

Answer 6

device that maintains a continuous supply of electrical power to connected equipment. A UPS is also called a battery backup. The battery will eventually run out

Question 7

program modification controls

Answer 7

include both controls designed to prevent changes by unauthorized personnel and controls that track program changes so that there is a record of what versions of what programs are running in production at any specific point in time

Question 8

data encryption

Answer 8

• essential foundation for electronic commerce
• uses a password or digital key to scramble a readable (plaintext) message into an unreadable (ciphertext) mesasge.
• the intended recipient then uses another digital key to decrypt or decipher the message back into plaintext.
• the longer the length of the key, the less likely is the message to be decrypted

Question 9

brute force attack

Answer 9

attacker simply tries every possible key until the right one is found

Question 10

digital certificates

Answer 10

electronic docs created and digitally signed by a trusted party which certifies the identity of owners of a particular public key

Question 11

PKI

Answer 11

Public key infrastructure

• the system and processes used to issue and manage asymmetric keys and digital certificates.
• the org that issues public and private keys and records the public key in the digital certificate is called a certificate authority -IE Verasign

Question 12

Digital signatures

Answer 12

Use asymmetric encryption to create legally binding electronic documents

Question 13

Esignature

Answer 13

an alternative to digital signatures and are provided by vendors as a software product. They are legally binding, as if the user had really signed the paper copy of the document.

Question 14

Managing passwords

Answer 14

The first rule in password policy is that every account must have a password

Question 15

Password length

Answer 15

general rule: minimum of 7 or 8 characters for password length

Question 16

Password complexity

Answer 16

feature three of the four characteristics:

• uppercase
• lowercase
• numeric characters
• symbols

Question 17

password age

Answer 17

no true standard; changing every 90 days is considered a good policy. Admin passwords should be changed more frequently

Question 18

Password reuse

Answer 18

no true standard; passwords should not be reused until a significant amount of time has passed

Question 19

initial passwords and authorization for user access to system

Answer 19

HR should generate the request for a user account and system access rights; Based on the level of access being granted, the Info Security officer may need to approve account

Question 20

Changes in position

Answer 20

Require the coordination of effort between HR & IT; It is important to have procedures in place for changes in jobs/roles and to remove access/disable accounts for terminated employes

Question 21

Policies

Answer 21

the most crucial element in a corporate information security infrastructure; must be considered long before security technology is acquired and deployed

Question 22

Security policy

Answer 22

document that states how an org plans to protect its tangible and intangible information assets

• mgmt instructions indicating a course of action, principle or procedure
• high level stmts providing guidance to workers who must make present and future decisions

Question 23

security policy goal

Answer 23

require people to protect info, which in turn protects hte org, its employees and its customers

Question 24

security policy secures information in 3 states

Answer 24

Stored information
Processed information
Transmitted information

Question 25

info resides in the following locations

Answer 25

IT systems
paper
human brain

Question 26

Program level policy

Answer 26

used for creating a mgmt sponsored computer security program. Might prescribe the need for info security and may delegate the creation and mgmt of a program to a role in the IT dept. This is the mission statement for the IT security program.

Question 27

Program framework policy

Answer 27

this is the IT security strategy-to achieve the mission statement. Establishes overall approach to computer security.

Question 28

issue specific policy

Answer 28

address specific issues of concern to the org ie-cloud computing

Question 29

system specific policy

Answer 29

focus on policy issues that exist for a specific system ie-payroll system

Question 30

3 level model to develop a comprehensive set of system polices

Answer 30

Security objectives
Operational security
Policy Implementation

Question 31

Security objectives

Answer 31

consist of a series of statements to describe meaningful actions about specific resources. Should be based on system functionality or mission reqs and state security actions to support the reqs
ie-confidentiality, data integrity, authorization, access, resource protection

Question 32

Operational security

Answer 32

define the manner in which a specific data operation would remain secure
ie-individuals authorized to make modifications

Question 33

policy implementation

Answer 33

ie-technology can be used to block telephone systems from calling certain numbers, website blocks, intrusion detection software